An internal penetration test (or pentest) aims at answering the question: “What could an attacker with access to the internal network, be able to do?”.
It is logical to assume that an attacker could gain physical access to the network, or could obtain remote access using malware. During an internal penetration test, we will analyze the network in an exploratory way, focusing on obtaining highly privileged (administrator, root) rights on the network, the assets and the complete Windows domain (if applicable). Internal applications, databases, ERP systems and management systems will also be tested during this phase. In a real world scenario, this is split between an initial exploratory part and a post-exploratory part.
In the initial exploratory part, our team will perform activities such as:
- Running exploits on vulnerabilities to gain access to systems;
- Sniffing network traffic;
- Accessing servers and assets with sensitive information;
- Information on shared folders and confidential information;
- Gaining access to email boxes (of specific employees).
In the post-exploitation part, our team will perform activities such as:
- Obtaining domain administrator credentials;
- Cracking passwords of domain users;
- Elevating privileges on servers, databases and applications;
- Cleaning up any access, we gave ourselves.
